Sigma rule: Files With System Process Name In Unsuspected Locations

Rule

Title

Files With System Process Name In Unsuspected Locations

Status

test

Level

medium

Author

Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

Date

2020-05-26

Modified

2026-07-28

File

rules/windows/file/file_event/file_event_win_creation_system_file.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        - '\AtBroker.exe'
        - '\audiodg.exe'
        - '\backgroundTaskHost.exe'
        - '\bcdedit.exe'
        - '\bitsadmin.exe'
        - '\cmdl32.exe'
        - '\cmstp.exe'
        - '\conhost.exe'
        - '\csrss.exe'
        - '\dasHost.exe'
        - '\dfrgui.exe'
        - '\dllhost.exe'
        - '\dwm.exe'
        - '\eventcreate.exe'
        - '\eventvwr.exe'
        - '\explorer.exe'
        - '\extrac32.exe'
        - '\fontdrvhost.exe'
        - '\fsquirt.exe' # was seen used by sidewinder APT - https://securelist.com/sidewinder-apt/114089/
        - '\ipconfig.exe'
        - '\iscsicli.exe'
        - '\iscsicpl.exe'
        - '\logman.exe'
        - '\LogonUI.exe'
        - '\LsaIso.exe'
        - '\lsass.exe'
        - '\lsm.exe'
        - '\msiexec.exe'
        - '\msinfo32.exe'
        - '\mstsc.exe'
        - '\nbtstat.exe'
        - '\odbcconf.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regini.exe'
        - '\regsvr32.exe'
        - '\rundll32.exe'
        - '\RuntimeBroker.exe'
        - '\schtasks.exe'
        - '\SearchFilterHost.exe'
        - '\SearchIndexer.exe'
        - '\SearchProtocolHost.exe'
        - '\SecurityHealthService.exe'
        - '\SecurityHealthSystray.exe'
        - '\services.exe'
        - '\ShellAppRuntime.exe'
        - '\sihost.exe'
        - '\smartscreen.exe'
        - '\smss.exe'
        - '\spoolsv.exe'
        - '\svchost.exe'
        - '\SystemSettingsBroker.exe'
        - '\taskhost.exe'
        - '\taskhostw.exe'
        - '\Taskmgr.exe'
        - '\TiWorker.exe'
        - '\vssadmin.exe'
        - '\w32tm.exe'
        - '\WerFault.exe'
        - '\WerFaultSecure.exe'
        - '\wermgr.exe'
        - '\wevtutil.exe'
        - '\wininit.exe'
        - '\winlogon.exe'
        - '\winrshost.exe'
        - '\WinRTNetMUAHostServer.exe'
        - '\wlanext.exe'
        - '\wlrmdr.exe'
        - '\WmiPrvSE.exe'
        - '\wslhost.exe'
        - '\WSReset.exe'
        - '\WUDFHost.exe'
        - '\WWAHost.exe'
filter_main_generic:
    # Note: It is recommended to use a more robust filter instead of this generic one, to avoid false negatives.
    TargetFilename|contains:
        # - '\SystemRoot\System32\'
        - 'C:\$WINDOWS.~BT\'
        - 'C:\$WinREAgent\'
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\Windows\uus\'
filter_main_tiworker:
    Image|endswith:
        - '\TiWorker.exe'
        - '\wuaucltcore.exe'
    TargetFilename|startswith: 'C:\Windows\Temp\'
filter_main_svchost:
    Image|endswith:
        - 'C:\Windows\system32\svchost.exe'
        - 'C:\Windows\SysWOW64\svchost.exe'
    TargetFilename|contains:
        - 'C:\Program Files\WindowsApps\'
        - 'C:\Program Files (x86)\WindowsApps\'
        - '\AppData\Local\Microsoft\WindowsApps\'
filter_main_wuauclt:
    Image:
        - 'C:\Windows\System32\wuauclt.exe'
        - 'C:\Windows\SysWOW64\wuauclt.exe'
        - 'C:\Windows\UUS\arm64\wuaucltcore.exe'
filter_main_explorer:
    TargetFilename|endswith: 'C:\Windows\explorer.exe'
filter_main_msiexec:
    # This filter handles system processes who are updated/installed using misexec.
    Image|endswith:
        - 'C:\WINDOWS\system32\msiexec.exe'
        - 'C:\WINDOWS\SysWOW64\msiexec.exe'
    # Add more processes if you find them or simply filter msiexec on its own. If the list grows big
    TargetFilename|startswith:
        - 'C:\Program Files\PowerShell\7\pwsh.exe'
        - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
        - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview\'
filter_main_healtray:
    TargetFilename|contains: 'C:\Windows\System32\SecurityHealth\'
    TargetFilename|endswith: '\SecurityHealthSystray.exe'
    Image|endswith: '\SecurityHealthSetup.exe'
filter_optional_wslhost:
    - TargetFilename: 'C:\Program Files\WSL\wslhost.exe'
    - TargetFilename|contains|all:
          - 'C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_'
          - '\wslhost.exe'
    - TargetFilename|contains|all:
          - 'C:\Users\'
          - '\AppData\Local\Microsoft\WindowsApps\'
          - '\wslhost.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• System processes copied outside their default folders for testing purposes
• Third party software naming their software with the same names as the processes mentioned here

Tags

• attack.stealth
• attack.t1036.005

MITRE ATT&CK ids this rule names

• T1036.005

References

• Internal Research

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_creation_system_file.yml